Add CORS headers when origin is supplied